How does POP3 work and why should security teams care?
ChatGPT
Claude
Gemini
Perplexity
GrokIn brief
How POP3 works step by step, why its download-and-delete model creates security gaps, and how MSPs can lock down or retire legacy mail clients.
POP3 (Post Office Protocol version 3) is the protocol old-school email clients use to pull messages down from a mail server, defined in RFC 1939 in 1996. A client connects, logs in with a username and password, downloads the mail, and in the classic setup deletes the server copy. Security teams should care for three reasons: mail ends up scattered across endpoints where it is hard to protect and preserve, POP3 grew up on password-only logins that dodge MFA, and deleted server copies punch holes in retention and incident response. Microsoft and Google have both shut off basic authentication for POP3, which tells you where this protocol is heading.
What is POP3?
POP3 is one of the two standard ways an email client retrieves mail from a server. It was published as RFC 1939 (Internet Standard 53) in May 1996 and designed for the dial-up era: connect briefly, pull everything down, then read offline. The protocol only handles retrieval. Sending is a separate job that belongs to SMTP, and the modern multi-device alternative for reading mail is IMAP.
Because it is so simple, POP3 support is baked into nearly every desktop client ever shipped, plus plenty of scanners, ticketing systems, and line-of-business apps that poll a mailbox. That install base is why MSPs still trip over it in 2026. For the short primer version, see What is POP3?
How does a POP3 session work step by step?
RFC 1939 defines three session states: AUTHORIZATION (log in), TRANSACTION (list and fetch mail), and UPDATE (apply deletions and hang up). A typical session looks like this:
S: +OK POP3 server ready
C: USER alice@example.com
S: +OK
C: PASS ********
S: +OK maildrop has 2 messages (620 octets)
C: LIST
S: +OK 2 messages (620 octets)
C: RETR 1
S: +OK 320 octets
S: <message content>
C: DELE 1
S: +OK message 1 deleted
C: QUIT
S: +OK POP3 server signing offThree details in that flow matter for security work:
- Authentication is a plain USER/PASS pair. The base protocol sends static credentials at the start of every session. Optional mechanisms (APOP, SASL) exist, but the lowest common denominator is a reusable password.
- DELE only marks messages. Nothing is removed until the client sends QUIT and the server enters the UPDATE state, where it deletes everything marked. A dropped connection leaves the mailbox intact, which is why deleted mail sometimes reappears.
- "Leave a copy on the server" is a client setting, not the default model. Clients that offer it use the optional UIDL command to remember which messages they already fetched. If that box is unticked, the server copy is gone the moment the download finishes.
What ports does POP3 use, and which should you allow?
| Port | What it is | Recommendation |
|---|---|---|
| 110 | POP3 in cleartext (optional STLS upgrade) | Block at the firewall unless a documented legacy device needs it |
| 995 | POP3 over implicit TLS ("POP3S") | Allow only if POP3 is still required |
| 143 / 993 | IMAP cleartext / IMAP over implicit TLS | Same logic: prefer 993, block 143 |
The IETF settled this argument in 2018. RFC 8314, titled "Cleartext Considered Obsolete," recommends TLS 1.2 or later for all traffic between mail clients and mail servers, and prefers implicit TLS on port 995 over upgrading a cleartext port-110 connection with STLS. NIST's SP 800-177 Rev. 1 gives the same advice for POP and IMAP clients: connect over TLS, and it calls authenticating with a username and password over an unencrypted connection "strongly discouraged." On port 110 without STLS, the username, password, and full message content cross the network readable by anyone in a position to sniff it. If you are new to how TLS protects a session, start there.
Why should security teams care about POP3?
Credentials are the big one. POP3 in practice means basic authentication: a static password presented on every poll, often every few minutes, from a client that cannot do MFA. Providers have concluded this is untenable. Microsoft disabled basic authentication for POP and IMAP in Exchange Online starting October 1, 2022, and it can no longer be re-enabled; POP/IMAP now require OAuth 2.0 there. Google followed: as of March 14, 2025, Google Workspace no longer accepts password-only sign-in for POP, IMAP, SMTP, CalDAV, and CardDAV, leaving OAuth (or app passwords) as the only path. A POP3 client still using a bare password today is talking to an on-prem or smaller hosted server, and those accounts are prime targets for credential theft because legacy protocols skip modern sign-in checks.
Mail sprawls onto endpoints. After download, the only copy of a message may live in a mailstore file on one laptop. Lose the laptop, lose the mail. Attachments also land straight on disk, so gateway filtering and endpoint protection have to carry the load; see how to handle malicious email attachments.
Investigations get harder. Once the server copy is deleted, nothing is left centrally to search during an incident or e-discovery request. Responders have to image endpoints instead of querying the mail platform. If clients are subject to retention rules (HIPAA, financial regulations, cyber-insurance requirements), download-and-delete can quietly put them out of compliance.
How is POP3 different from IMAP?
IMAP keeps mail on the server and syncs read/unread state, folders, and deletions across every device. POP3 pulls mail to one device and, by default, removes it from the server. For security and compliance the difference is stark: IMAP centralizes data you can back up, search, and preserve; POP3 fragments it across endpoints. Few cases remain where POP3 wins: a single-device user on a server with hard storage quotas, or a legacy appliance that speaks nothing else. Treat those as exceptions with an expiry date, not architecture.
How do you secure POP3 if you cannot retire it yet?
- Inventory first. Pull sign-in or protocol logs from each mail platform and list every account using POP3, what client it is, and why. Expect service mailboxes, scanner or ticketing integrations, and a few individual holdouts.
- Force TLS. Allow port 995 only, disable cleartext logins on 110, and require TLS 1.2+, per RFC 8314.
- Kill bare passwords. On Microsoft 365 and Google Workspace this is already done for you. Elsewhere, require OAuth-capable clients or unique app passwords, and enforce MFA on the account itself.
- Turn on "leave a copy on the server" via managed client configuration, and archive at the gateway so a copy exists before any client downloads it.
- Monitor the accounts. Alert on POP3 logins from new IP ranges or countries, spikes in failed logins, and full-mailbox downloads in one session. These are cheap, high-signal detections for account takeover.
- Set a migration date. Move users to IMAP or native cloud clients, and replace mailbox-polling integrations with APIs.
Does POP3 affect SPF, DKIM, or DMARC?
Not directly. SPF, DKIM, and DMARC authenticate mail at the receiving server, before anything reaches a mailbox, so messages a POP3 user downloads have already passed or failed those checks. Retrieval and sender authentication are separate layers; you need both. Two honest caveats: DMARC protects only your exact domain, not lookalike domains that phishers register, and a basic POP3 client gives users fewer visual warnings than webmail, so mail that lands despite a failed check gets less scrutiny. While you clean up legacy access on the receiving side, run a client domain through Palisade's free email security score to check the sending side.
Common issues
A POP3 client suddenly cannot sign in to Microsoft 365 or Gmail. The password is not wrong; basic authentication is gone. Exchange Online requires OAuth for POP/IMAP (and Microsoft says there is no plan for Outlook clients to support OAuth for POP and IMAP), and Google Workspace requires OAuth or an app password. Fix: switch to an OAuth-capable client or issue an app password where policy allows.
Mail disappeared from webmail after someone set up a desktop client. That is POP3's download-and-delete default doing its job. Enable "leave messages on server" in the client, then restore from the gateway archive or backup if copies were removed.
The same messages download twice. The client lost its UIDL cache, or the server does not support UIDL, so it cannot tell what it already fetched. Clear the cache and confirm UIDL support server-side.
Connections to port 110 time out. A firewall is (correctly) blocking it. Reconfigure the client for port 995 with SSL/TLS instead of asking for an exception.
Certificate errors on connect. The client is usually pointed at the wrong hostname (the domain instead of the provider's mail host), or the server has an expired certificate or TLS below 1.2. Fix the server name first.
Related reading
Questions readers ask
Frequently asked questions
Written by
Taylor TabusaCo-Founder & Head of Business Development, Palisade
Taylor Tabusa is the co-founder and Head of Business Development at Palisade, helping managed service providers turn email security into a practical, valuable service.
More from Taylor →
